Let's start with an uncomfortable question. When's the last time you actually looked at what's running when you open Docker Desktop, versus what you think is running? Because I did, and it ruined my week a little, so now it's going to ruin yours too.
From "lightweight alternative to VMs" to the thing it was built to replace
Here's the pitch Docker sold everyone around 2013: forget heavy virtual machines, forget booting a whole guest OS just to run one process, containers share the host kernel and give you VM-like isolation for a fraction of the overhead. Genuinely great idea. Genuinely changed how the entire industry ships software. Nobody's arguing with the concept.
The problem is what happened to the implementation on the two operating systems most developers actually use day to day. On macOS and Windows, Docker Desktop runs every single container inside a hidden Linux virtual machine — LinuxKit on the backend, spun up the moment you launch the app. Yes, really: the tool whose entire founding pitch was "you don't need a VM anymore" ships you one anyway, just quietly, behind a whale icon, so you don't have to think about it. It's giving "we don't sell your data, we just process it" energy, and if that sentence means something to you, you already know exactly the kind of institutional gaslighting I'm talking about.
That VM idles at somewhere around 1-4GB of RAM doing absolutely nothing — no containers running, no builds happening, just existing, breathing, judging you from the menu bar. On Windows the overhead is worse: Microsoft's own docs flag roughly an extra 4GB of memory requirement specifically because you're running a VM on top of a host that isn't natively Linux. Compare that to a native Linux box, where the "VM" is just... the kernel you already have. Docker on Linux doesn't need this charade. Docker on your MacBook does, and it's been quietly costing you a chunk of your RAM budget since the day you installed it.
The GUI is a browser pretending to be a dashboard
Here's the part that should genuinely make you angry once you know it: Docker Desktop's dashboard — the pretty window that shows you a list of running containers and their logs — is an Electron app. Which means, under the hood, it's Chromium. A full web browser. Docker's own public roadmap confirms it outright, and their own release notes have shipped fixes for the dashboard throwing ERR_FAILED errors because process-hardening policies conflicted with Chromium — an error message that should not exist in a tool whose entire job is "show text in a box." Security researchers have literally opened the Chrome DevTools console inside Docker Desktop using a Konami-code-style key combo, because it's Chromium under a trench coat, and Chromium ships DevTools.
Sit with that for a second. The tool that replaced heavyweight virtual machines with "lightweight" containers is now shipping you a second heavyweight virtual machine, wrapped in a second heavyweight browser engine, so you can look at logs you could've read with docker logs -f and a text editor that's been installed on your machine since 2004.
The years-long soap opera of just... reading a file
If the VM and the browser-in-a-box weren't enough, let's talk about what happens when you mount your actual project folder into a container — something approximately every developer using Docker on a Mac does on day one. For years, the default file-sharing backend was osxfs, and osxfs was, to use the precise technical term, garbage. Developers running Symfony, Laravel, or anything with a bloated node_modules folder would watch page loads take multiple seconds because every file read had to cross the host-to-VM boundary through a genuinely slow translation layer. Docker's answer was gRPC-FUSE, which was faster, in the same sense that being hit by a slightly smaller truck is an improvement. It took until 2022 for VirtioFS to finally ship as a real fix, and Docker's own benchmarks claimed up to 98% faster file sync versus the old backend.
Here's the punchline: even with VirtioFS, independent benchmarks still show it running 2-5x slower than native Linux for workloads with lots of small files — which describes precisely the node_modules situation that made Mac developers' hair go gray in the first place. You went from "unusably slow" to "noticeably slow," and Docker shipped a blog post celebrating it like they'd solved the problem instead of just making the tax smaller.
In 2021, Docker changed the terms: Docker Desktop went from "free forever, no asterisks" to "free unless your company crosses 250 employees or USD 10 million in revenue, in which case pay up." Fair enough, companies need revenue, I'm not going to pretend GPL-licensed goodwill pays anyone's rent. But by 2026 the tiers have fully calcified into the SaaS pricing ladder you'd expect from a project management tool, not a container runtime: Personal is free, Pro runs about USD 9 per user per month, Team lands around USD 15 per user per month, and Business tops out near USD 24 per user per month for the privilege of SSO, audit logs, and something called "Hardened Docker Desktop" — which is a genuinely funny name for a security feature, implying the regular one is, what, soft? Squishy? Vulnerable to a stiff breeze?
Annual billing barely helps on the top tier either — Business gets effectively zero discount for committing a year in advance, which is the kind of pricing decision that only makes sense if you've already accepted that switching costs are your actual product. And here's the twist that should bother you more than the price tag: Docker's own list pricing has been creeping up 3-7% a year through 2025-2026, the exact playbook every SaaS company runs once they know you're locked in. You didn't sign up for a subscription. You signed up for a Docker Desktop-shaped mortgage.
And it doesn't even wait to be asked. By default, Docker Desktop adds itself to your login items, so you open your laptop to check one email or watch one YouTube video, and somewhere behind your open tabs a multi-gigabyte VM has already quietly spun itself up and started warming your lap through the chassis for containers you have no intention of running today.
Meanwhile, the actual alternatives got quietly good
This is normally the part of the post where I'd tell you to just suffer through it because "there's no real alternative." That stopped being true a while ago, and pretending otherwise at this point is just Stockholm syndrome with extra steps.
Podman is the one worth taking seriously first, because it doesn't ask you to change how you think, just what daemon you trust. No background daemon running as root by default — Podman runs containers as your own user, rootless, which means a container escape doesn't hand an attacker root on your actual machine, it hands them your own limited user account, which is a considerably less exciting Tuesday for everyone involved. It speaks the same OCI image format, the CLI is close enough to Docker's that muscle memory mostly survives the switch (alias docker=podman and half your team won't even notice), and it doesn't need a hidden VM babysitting a whale icon just to exist. If your objection to switching is "but my docker-compose.yml files," Podman Compose exists specifically to make that objection irrelevant.
Nix and NixOS are the other end of the spectrum, and I'm not going to pretend this one is for everyone — it's for the specific flavor of masochist who reads a man page for fun and considers make "too much magic." Nix's whole premise is that you don't containerize your environment, you declare it: a Nix expression describes exactly which packages, which versions, which dependencies your project needs, and Nix builds that environment reproducibly, byte-for-byte, on any machine running the Nix package manager — no container boundary required, because the isolation comes from content-addressed, immutable package derivations instead of kernel namespaces. It's genuinely the most correct solution to "works on my machine" that currently exists. It is also, in fairness, the solution most likely to have you debugging a syntax error in a language that looks like someone smashed Haskell and JSON together at 2am. Hardcore. Occasionally the right answer anyway.
And if the previous two paragraphs made your palms sweat because you actually like having a window with buttons in it — fair, not everyone wants to live in a terminal. Colima is the unofficial Mac-community hero here: it spins up a genuinely minimal VM using macOS's own native virtualization framework and hands you a clean Docker-compatible CLI, no Electron, no subscription tiers, no telemetry dashboard, at a fraction of Docker Desktop's footprint. Rancher Desktop covers similar ground with an actual GUI attached, for people who want Podman or dockerd under the hood but still want to click a button instead of memorizing flags. Neither one asks about your headcount. Neither one ships you a browser to read log lines.
So what do you actually do with this
Nobody's saying rip Docker out of your CI pipeline this afternoon — for a lot of teams, the GUI, Docker Scout's vulnerability scanning, and Build Cloud's CI acceleration genuinely earn their subscription, and that's a legitimate trade to make with eyes open. But if you're a solo developer or a small team paying the Personal-tier RAM tax just to run docker build and docker run locally, you are paying VM overhead and possibly a subscription fee for functionality Podman gives you for free, without the hidden VM, without the daemon running as root, and without ever once asking about your headcount.
Try Podman for a week on your actual local workflow. If your muscle memory survives the alias, you've just gotten your RAM back for nothing. If it doesn't — fine, go back to the whale, no judgment, some relationships are just complicated. But at least now you know exactly what you're paying for, and exactly what's quietly running behind it every time you open the app.